Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1370918

Re: [RFC] Create an audit record of USB specific details

From Paul Moore <paul@paul-moore.com>
Newsgroups linux.kernel
Subject Re: [RFC] Create an audit record of USB specific details
Date 2016-04-04 23:40 +0200
Message-ID <rkko3-VB-21@gated-at.bofh.it> (permalink)
References <rk3ZU-5Sj-1@gated-at.bofh.it> <rkcgN-388-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


On Monday, April 04, 2016 05:56:26 AM Greg KH wrote:
> On Mon, Apr 04, 2016 at 12:02:42AM -0400, wmealing wrote:
> > From: Wade Mealing <wmealing@redhat.com>
> > 
> > Gday,
> > 
> > I'm looking to create an audit trail for when devices are added or removed
> > from the system.
> 
> Then please do it in userspace, as I suggested before, that way you
> catch all types of devices, not just USB ones.

Audit has some odd requirements placed on it by some of its users.  I think 
most notable in this particular case is the need to take specific actions, 
including panicking the system, when audit records can't be sent to userspace 
and are "lost".  Granted, it's an odd requirement, definitely not the 
norm/default configuration, but supporting weird stuff like this has allowed 
Linux to be used on some pretty interesting systems that wouldn't have been 
possible otherwise.  Looking quickly at some of the kobject/uvent code, it 
doesn't appear that the uevent/netlink channel has this capability.

It also just noticed that it looks like userspace can send fake uevent 
messages; I haven't looked at it closely enough yet, but that may be a concern 
for users which restrict/subdivide root using a LSM ... although it is 
possible that the LSM policy could help here.  I'm thinking aloud a bit right 
now, but for SELinux the netlink controls aren't very granular and sysfs can 
be tricky so I can't say for certain about blocking fake events from userspace 
using LSMs/SELinux.

-- 
paul moore
www.paul-moore.com

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[RFC] Create an audit record of USB specific details  wmealing <wmealing@redhat.com> - 2016-04-04 06:10 +0200
  Re: [RFC] Create an audit record of USB specific details Oliver Neukum <oneukum@suse.com> - 2016-04-04 08:50 +0200
    Re: [RFC] Create an audit record of USB specific details Bjørn Mork <bjorn@mork.no> - 2016-04-04 09:50 +0200
      Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-05 10:50 +0200
        RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 14:10 +0200
          Re: EXT :Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 15:50 +0200
            RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:00 +0200
              Re: EXT :Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 17:40 +0200
        Re: [RFC] Create an audit record of USB specific details Alan Stern <stern@rowland.harvard.edu> - 2016-04-05 16:50 +0200
          Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-06 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Oliver Neukum <oneukum@suse.com> - 2016-04-05 19:10 +0200
          Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-05 21:40 +0200
            Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-06 00:20 +0200
  Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-04 15:00 +0200
    Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-04 23:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 15:10 +0200
          Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 15:50 +0200
            RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:30 +0200
              RE: EXT :Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 16:40 +0200
                RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:50 +0200
                RE: EXT :Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-06 00:50 +0200
            Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 16:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
    Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-04 23:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-05 05:00 +0200
          Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 05:40 +0200
            Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-05 17:00 +0200
  Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-04 23:40 +0200
    Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 00:20 +0200
      Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-05 04:00 +0200
        Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 04:50 +0200
        Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 04:50 +0200
    Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 00:20 +0200

csiph-web